Information Security Competency Certification Body

Under Article 1 point 14 of BSSN Regulation Number 8 of 2020. An Auditor Keamanan Informasi (ArKI) is a person possessing the competence to conduct an Information Security audit. Certification Bodies assign an ArKI team to audit the Information Security Management System (Sistem Manajemen Pengamanan Informasi or SMPI). This audit is required before issuing an SMPI Certificate (Article 30).

Role Within the SMPI Certification Framework

BSSN Regulation 8/2020 implements Article 24(4) of PP Number 71 of 2019. Electronic system security is carried out through SMPI (Article 2) across three electronic system tiers—strategic, high. Alternatively, Low—with SNI ISO/IEC 27001 required across all three tiers alongside tier-specific requirements (Article 9).

SMPI certification is performed by a BSSN-recognized Certification Body (Articles 26-27). Under Article 30, the Certification Body assigns an ArKI team to audit the provider's SMPI, reviews the team's audit report. In addition, Issues the SMPI Certificate when standards are met.

Surveillance Audits, Incident Audits, and 90-Day Remediation

An SMPI Certificate is valid for up to three years (Article 28(2)). The Certification Body must conduct a surveillance audit at least once a year. Plus a special audit if a security incident occurs on a certified electronic system (Article 33). If a surveillance audit finds non-compliance, the provider has up to 90 calendar days to remediate. failure to meet the standard within that window can result in certificate revocation (Article 34). For healthcare facilities or vendors holding SMPI certification, audit readiness is an ongoing annual obligation.

Related Terms in BSSN Regulation 8/2020

• Implementation Specialist (Tenaga Ahli Penerap): A professional competent to implement SMPI internally, distinct from an ArKI who audits it (Article 1 point 16).
• KAMI Index (Indeks KAMI): A readiness evaluation tool organizations may use to prepare for SNI ISO/IEC 27001 implementation (Article 1 point 13. Article 12(1)).

Legal basis: BSSN Regulation Number 8 of 2020 Articles 1 points 13, 14, and 16, 2, 9, 12(1), 26, 27, 28(2), 30, 33, and 34. PP Number 71 of 2019 Article 24(4).